{"id":"GHSA-897f-g5gm-fmxm","summary":"Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation","details":"## Summary\n\nIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.\n\nCranelift was changed in Wasmtime v43 to use a full `u32` index, with checks if that limit is exceeded, and so is no longer susceptible to this bug.\n\n## Impact\n\nA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module.\n\n## Patches\n\nWasmtime v36.0.19 has been released which fixes this issue.","aliases":["CVE-2026-115889","RUSTSEC-2026-0380"],"modified":"2026-10-23T22:25:51.511659839Z","published":"2026-10-23T22:02:20Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-197","CWE-843"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-10-23T22:02:20Z"},"references":[{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/pull/12613"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/pull/14818"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"},{"type":"PACKAGE","url":"https://github.com/bytecodealliance/wasmtime"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0380.html"}],"affected":[{"package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"36.0.19"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-897f-g5gm-fmxm/GHSA-897f-g5gm-fmxm.json"}},{"package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"37.0.0"},{"fixed":"43.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-897f-g5gm-fmxm/GHSA-897f-g5gm-fmxm.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}